What is an API integration?
An API integration connects two software systems so they exchange data automatically. Instead of manually copying information from your e-commerce platform to your accounting software, the systems communicate directly. This saves time, prevents human errors, and makes your business processes scalable.
API stands for Application Programming Interface. It is a set of rules and protocols that allow one piece of software to communicate with another. Think of it as a standardized contract between systems: if you send a request in this format, you will receive a response in that format. The majority of modern business software exposes an API, making integration possible — and increasingly expected by users.
REST vs. GraphQL
The two most common API styles are REST and GraphQL. For most business integrations, you will work with REST, simply because nearly all business software offers REST APIs.
REST
REST APIs work with standardized conventions for exchanging data. You can retrieve records, create new ones, update existing data, or delete entries. Each data type has its own endpoint (URL) within the API. For example, you might fetch all invoices from one endpoint or retrieve a specific invoice by its ID from another.
REST is straightforward to understand, broadly supported, and sufficient for 90% of business integrations you will encounter. The OpenAPI Specification has become the industry standard for documenting REST APIs, making integration development more predictable.
GraphQL
GraphQL lets the client specify exactly which data it needs. Instead of a fixed response per endpoint, you send a query describing which fields you want. This is valuable when dealing with complex, nested data structures where you would otherwise need multiple REST calls to assemble the information you need.
In practice, most business applications — Salesforce, HubSpot, QuickBooks, Xero, Stripe — offer REST APIs as their primary interface. GraphQL appears more frequently in modern SaaS platforms like Shopify and in products built by developer-focused companies.
Manually copying data between systems is not just inefficient — it is a ticking time bomb of errors that costs your business real money every month.
Authentication: who gets access?
Every API needs to verify who is making requests. There are three commonly used authentication methods, each with different security characteristics:
API keys
The simplest form of authentication. You receive a unique key that you include with every request. Simple and effective for direct server-to-server communication. The downside: if the key leaks, someone has full access to the integration. Always store API keys in environment variables, never in source code or version control.
OAuth 2.0
The industry standard for integrations where a user grants permission. The user logs into the external service, authorizes your application, and you receive an access token and a refresh token. The access token expires after a short period; the refresh token is used to obtain new access tokens without requiring the user to log in again. Most major platforms — Salesforce, Google Workspace, Microsoft 365, Xero — use OAuth 2.0.
OAuth is more complex to implement but significantly more secure. The user can revoke access at any time, tokens expire automatically, and you never need to store user passwords.
JWT (JSON Web Tokens)
A widely used method where the system issues a digitally signed token containing information about the user's identity and permissions. The recipient can verify the token's authenticity without making a separate validation request, making it efficient for high-throughput integrations.
Rate limiting: working within constraints
Every API imposes limits on the number of requests you can send per time period. Depending on the service and your subscription tier, you might be allowed 60 to 1,000 requests per minute — or sometimes far more.
When you exceed the limit, the external system temporarily rejects further requests, typically returning an HTTP 429 status code. A well-built integration handles this automatically: it waits the appropriate duration (often specified in a Retry-After header) and retries, without any visible impact to users or data integrity.
For larger synchronizations — such as importing an entire customer database from a CRM — the integration automatically processes data in manageable batches, respecting rate limits while maximizing throughput.
Error handling: expect the unexpected
External systems go offline, network connections drop, and data gets rejected. A professional integration anticipates these scenarios and handles problems automatically. This is the area where most integrations either prove their worth or reveal their weaknesses.
What a production-grade integration requires:
- Comprehensive logging — Every API request and response is recorded, so when problems occur you can quickly trace what happened, when, and why.
- Automatic retries with exponential backoff — When temporary failures occur, the integration retries automatically with progressively longer wait times. This prevents overwhelming a struggling service while ensuring eventual delivery.
- Graceful degradation — If the integration is temporarily unavailable, your core application continues to function. Actions are queued and processed when the connection recovers. Users should never see an error because an external API is down.
- Active monitoring and alerting — You receive notifications when something is systematically failing, so you can intervene before it becomes a business-critical issue.
- Idempotency — Retried requests must not create duplicate records. Every integration should be designed so that sending the same request twice produces the same result as sending it once.
Webhooks vs. polling
There are two fundamental approaches to knowing when something has changed in an external system:
Polling
You periodically ask the external system: "Is there anything new?" For example, checking for new orders every 5 minutes. This is simple to implement but inherently inefficient. You make many unnecessary requests when nothing has changed, and there is always a delay between when data changes and when you detect it.
Webhooks
The external system sends a notification to your application the moment something changes. This is faster, more efficient, and provides near-real-time data synchronization. Your system receives the update immediately and can act on it without delay.
In practice, Coding Agency Meppel uses webhooks wherever the external service supports them. When a system does not offer webhooks, or as a safety net for missed webhook deliveries, we combine them with periodic polling checks. This belt-and-suspenders approach ensures no data is ever lost.
An integration that fails silently is worse than one that fails loudly. Build your integrations as if they will break tomorrow — because eventually, they will.
Data mapping: the hidden complexity
The technical connection is often the easy part. The real challenge lies in data mapping: how do you translate data from one system to another in a way that preserves meaning and accuracy?
Customer IDs differ between systems, product categories do not match, date formats vary, required fields in one system do not exist in the other, and status values use different naming conventions. This requires clear transformation rules that are defined before development begins.
Key questions that must be answered upfront: Which field in system A corresponds to which field in system B? What happens when a required value is missing? How do you handle values that do not have an equivalent in the target system? What is the source of truth when both systems have conflicting data? At Coding Agency Meppel, we document all mapping rules before writing integration code — it prevents the most common and costly integration failures.
Common business integrations
- CRM — Salesforce, HubSpot, Pipedrive. Synchronize customer data, deals, and communication history across systems.
- Accounting — QuickBooks, Xero, FreshBooks. Automatically process invoices, payments, and financial data without manual entry.
- E-commerce — Shopify, WooCommerce, BigCommerce. Keep orders, inventory, and product catalogs synchronized in real time.
- Payments — Stripe, PayPal, Mollie. Synchronize payment statuses with your order management system and trigger automated workflows on payment events.
- Logistics — UPS, FedEx, DHL, ShipStation. Generate shipping labels, track packages, and automatically update customers with delivery status.
- Communication — Slack, Microsoft Teams, email services. Automate notifications, alerts, and status updates across your team's communication channels.
How we approach API integrations
A successful integration does not start with writing code. These are the steps Coding Agency Meppel follows for every integration project:
- Define the objective — What problem are we solving? What data needs to flow where, and in which direction?
- Inventory capabilities — What does the external API offer? What are its limitations, rate limits, and quirks? Is the documentation accurate and complete?
- Document data mapping — Which fields connect to which? How do we handle exceptions, missing values, and edge cases?
- Choose a synchronization strategy — Real-time webhooks, periodic polling, or a hybrid approach? What are the latency requirements?
- Design error handling — What happens when things go wrong? How does the system recover automatically? Who gets notified and when?
- Build and test — Develop in a staging environment first, then deploy to production with real data only after thorough testing.
- Set up monitoring — Deploy dashboards and alerts so you know the integration is healthy at all times. Problems should be detected before users notice them.
Do not skip any step. Most failed integrations fail not because of technical problems, but because of unclear requirements, undocumented mapping rules, or absent error handling.
Most failed integrations do not fail on technology — they fail on poor preparation and missing error handling.
